Polluting Storm
Dark Reading had recently an article about our work on Storm Worm entitled "Researchers Infiltrate and 'Pollute' Storm Botnet" (also featured on /.). The article quotes Jose Nazario:
Just to clarify: We did not inject commands into Storm Worm, but just interfered with the communication process as explained in our LEET'08 paper. No commands were executed on an infected machine, we just injected packets into the communication process in order to stop the C&C channel. In practice, this does not affect an infected machine, no extra network packets or CPU cycles are used on an infected machine.
Slashdot had also covered our work a few days ago: Storm Dismantled at USENIX LEET Workshop.
"This has been a taboo subject of exploration, as people do not want to mess with other peoples' PCs by injecting commands," he says.
Just to clarify: We did not inject commands into Storm Worm, but just interfered with the communication process as explained in our LEET'08 paper. No commands were executed on an infected machine, we just injected packets into the communication process in order to stop the C&C channel. In practice, this does not affect an infected machine, no extra network packets or CPU cycles are used on an infected machine.
Slashdot had also covered our work a few days ago: Storm Dismantled at USENIX LEET Workshop.
".
